Research explained
AWS linked FortiGate compromises to weak credentials and exposed management ports
Amazon’s investigation found AI-assisted scaling of familiar techniques, with no FortiGate vulnerability exploitation observed in that campaign.
What happened
Amazon Threat Intelligence reported a campaign compromising more than 600 FortiGate devices across over 55 countries between January 11 and February 18, 2026. The investigators attributed the operation to a Russian-speaking, financially motivated actor using commercial AI services.
AWS said it observed exposed management ports and weak, single-factor credentials rather than exploitation of FortiGate software vulnerabilities. That distinction changes the appropriate response and avoids inventing a new zero-day.
Restrict management interfaces, strengthen authentication and investigate unauthorized administrative access. AI assistance may accelerate familiar techniques, but the access controls that failed in this campaign remain concrete and testable.
Next step
Restrict management exposure and investigate weak or reused administrative credentials.
What remains unknown
- Open question
- The sources reviewed do not establish whether your deployment was exploited.
Source references
-
AWS